{
  "id": "r1",
  "recordedAt": "2026-10-25T21:20:34.569200538Z",
  "summary": "lab-emr: configured HTTP probe passed. lab-emr-database: container main-process running flag = 1. lab-guest-application: reported dependency check for lab-emr is unknown; reported dependency check for lab-storage is unknown; configured HTTP probe failed. lab-storage: reported storage available bytes = 654227234816 bytes; reported storage capacity = 1081101176832 bytes; storage health probe passed. lab-virtual-machine: reported VM running flag = 0. These observations do not establish overall health or an underlying cause.",
  "disposition": "historical-unexecuted",
  "originalAction": {
    "title": "Inspect QEMU VM execution state and events",
    "reason": "lab-virtual-machine: reported VM running flag = 0.",
    "condition": "A human operator must verify the QMP socket state, inspect the QEMU VM event log for the specific stop reason, and approve the inspection before proceeding.",
    "evidenceRefs": [
      "current.e10"
    ],
    "contextRefs": [
      "c10",
      "runbook.c14"
    ]
  },
  "references": [
    {
      "ref": "current.e10",
      "kind": "measurement",
      "label": "QMP reports runnable VM vCPUs; this is not guest or application readiness",
      "text": "Value: 0 (boolean); evidence status: ok.",
      "recordedAt": "2026-10-25T21:18:39.905003+00:00",
      "evidence": [
        {
          "id": "r1-current.e10",
          "label": "Original action reference",
          "href": "/demos/operator-investigation/report-r1.json"
        }
      ]
    },
    {
      "ref": "c10",
      "kind": "context",
      "label": "Approved qemu integration",
      "text": "This actual Alpine Linux QEMU VM uses intentional TCG software emulation,768MiB and2vCPUs. Its kernel/initramfs boot locally; its boot disk does not depend on Garage. The guest application separately reads a Garage object and OpenEMR readiness. QMP running is runnable vCPUs, not application or storage health.",
      "recordedAt": null,
      "evidence": [
        {
          "id": "r1-c10",
          "label": "Supplied context excerpt",
          "href": "/demos/operator-investigation/report-r1.json"
        }
      ]
    },
    {
      "ref": "runbook.c14",
      "kind": "context",
      "label": "Cross-domain investigation and recovery checks",
      "text": "Trace only the approved dependency edges; do not assume that every VM boot disk depends on an application storage service. Compare independent storage probes, native VM execution state and configured application probes at the same incident time. A running flag does not establish overall health. A responsive, identity-checked QMP non-running observation is different from unavailable QMP collection. An unavailable guest endpoint cannot report the outcomes of its internal dependency checks: those checks remain unknown, not failed upstream storage or EMR checks. An independent storage or EMR probe passing does not prove that the unreachable guest can access it. Choose the inspection layer from observed evidence: inspect VM execution state and events when its native state is non-running; inspect the storage service/request path when measured storage checks fail. Do not assume a root cause from correlation. A protocol connection or FHIR metadata response does not establish clinical functionality, camera video quality, badge call quality or successful printing. Any infrastructure change requires the responsible human operator to verify the specific fault and supplied runbook preconditions, review impact and approve the change. After recovery verify fresh application, dependency and VM/storage observations plus Grafana resolved notifications. Never execute infrastructure changes from model output.",
      "recordedAt": null,
      "evidence": [
        {
          "id": "r1-runbook.c14",
          "label": "Supplied context excerpt",
          "href": "/demos/operator-investigation/report-r1.json"
        }
      ]
    }
  ],
  "evidence": [
    {
      "id": "report-r1",
      "label": "Original action and summary",
      "href": "/demos/operator-investigation/report-r1.json"
    }
  ]
}